diff options
| author | Li Qiang <liqiang6-s@360.cn> | 2017-02-07 02:23:33 -0800 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2017-02-21 08:11:42 +0100 |
| commit | 95ed56939eb2eaa4e2f349fe6dcd13ca4edfd8fb (patch) | |
| tree | e24130153d36a5d09f3dbb724c585aa7eb2ecb16 | |
| parent | 26f670a244982335cc08943fb1ec099a2c81e42d (diff) | |
usb: ohci: limit the number of link eds
The guest may builds an infinite loop with link eds. This patch
limit the number of linked ed to avoid this.
Signed-off-by: Li Qiang <liqiang6-s@360.cn>
Message-id: 5899a02e.45ca240a.6c373.93c1@mx.google.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| -rw-r--r-- | hw/usb/hcd-ohci.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c index 2cba3e3b5b..21c93e0372 100644 --- a/hw/usb/hcd-ohci.c +++ b/hw/usb/hcd-ohci.c @@ -42,6 +42,8 @@ #define OHCI_MAX_PORTS 15 +#define ED_LINK_LIMIT 4 + static int64_t usb_frame_time; static int64_t usb_bit_time; @@ -1184,7 +1186,7 @@ static int ohci_service_ed_list(OHCIState *ohci, uint32_t head, int completion) uint32_t next_ed; uint32_t cur; int active; - + uint32_t link_cnt = 0; active = 0; if (head == 0) @@ -1199,6 +1201,11 @@ static int ohci_service_ed_list(OHCIState *ohci, uint32_t head, int completion) next_ed = ed.next & OHCI_DPTR_MASK; + if (++link_cnt > ED_LINK_LIMIT) { + ohci_die(ohci); + return 0; + } + if ((ed.head & OHCI_ED_H) || (ed.flags & OHCI_ED_K)) { uint32_t addr; /* Cancel pending packets for ED that have been paused. */ |